DiSCO: Defending text-to-image generation through distribution-guided contrastive prompt optimization

arXiv:2608.170672026-08-16

A text-to-image prompt can look perfectly safe and still generate unsafe images, so this method rewrites the prompt itself, without touching the model, to steer it away

Text-to-image models can produce unsafe images even from prompts that pass language-level safety checks, because the model's own learned visual distribution still leans toward harmful content. DiSCO fixes this by building safe and unsafe image pools from the target model's own outputs and using beam search to append suffix tokens that push generation, in CLIP embedding space, toward the safe pool and away from the unsafe one, all without accessing model weights. Across 32 system-attack settings and five seeds, it cut average attack success rate from 23.6% to 2.4% under NudeNet and from 8.3% to 1.7% under Q16.

METAL MEDIA explanatory visual

A text-to-image prompt can look perfectly safe and still generate unsafe images, so this method rewrites the prompt itself, without touching the model, to steer it away

01Defines the 'benign adversarial' problem: prompts that pass text-level safety checks but still trigger unsafe image generation due to the model's learned data distribution
02Builds model-specific safe/unsafe reference image pools by generating images from I2P dataset prompts and keeping only cases where both NudeNet and Q16 classifiers agree, then uses a beam search with a language model (LLaMA-3-8B) to expand the prompt with suffix tokens that maximize similarity to the safe pool and minimize similarity to the unsafe pool in CLIP embedding space
03Requires no model retraining, fine-tuning, or access to internal weights or gradients, working purely by querying the model's outputs
04Applied on top of undefended models (SD v1.4, SD v2.0, Flux, SD3) and existing defenses (SLD-Max, SAFREE, RECE, ESD), it reduced attack success rate in all 32 tested combinations while also improving CLIP alignment and ImageReward quality scores
05Ablations show performance stays stable even when the reference pool is shrunk to 25% of its original size, and the moderate default beam search settings (K=4, T=16) balance safety and semantic fidelity

An explanatory diagram made by METAL MEDIA, not a figure supplied by the paper's authors.

What they did

Defines the 'benign adversarial' problem: prompts that pass text-level safety checks but still trigger unsafe image generation due to the model's learned data distribution
Builds model-specific safe/unsafe reference image pools by generating images from I2P dataset prompts and keeping only cases where both NudeNet and Q16 classifiers agree, then uses a beam search with a language model (LLaMA-3-8B) to expand the prompt with suffix tokens that maximize similarity to the safe pool and minimize similarity to the unsafe pool in CLIP embedding space
Requires no model retraining, fine-tuning, or access to internal weights or gradients, working purely by querying the model's outputs
Applied on top of undefended models (SD v1.4, SD v2.0, Flux, SD3) and existing defenses (SLD-Max, SAFREE, RECE, ESD), it reduced attack success rate in all 32 tested combinations while also improving CLIP alignment and ImageReward quality scores
Ablations show performance stays stable even when the reference pool is shrunk to 25% of its original size, and the moderate default beam search settings (K=4, T=16) balance safety and semantic fidelity

Figure 2: Overview of DiSCO. Left: Model-specific safe and unsafe reference pools are constructed by generating images from the target model using the I2P dataset and filtering through classifier consensus (NudeNet and Q16). Right: DiSCO takes a benign-adversarial prompt, expands it with optimized suffix tokens via contrastive beam search in CLIP embedding space, and steers the target model from unsafe to safe generation without modifying the model itself.

Table 1: ASR (%, mean±std over 5 seeds) under four adversarial attacks, measured by NudeNet (NN) and Q16. Lower is better.
		Ring-A-Bell	UnlearnDiffAtk	MMA-Diffusion	P4D
Model		NN↓	Q16↓	NN↓	Q16↓	NN↓	Q16↓	NN↓	Q16↓
SD 1.4	Base	84.2±3.8	16.0±9.5	53.1±10.9	13.1±3.3	43.0±16.9	11.8±4.7	17.5±8.6	12.9±6.6
	+ DiSCO	7.8±3.0	4.0±2.9	6.2±2.5	3.4±2.5	8.0±1.7	3.2±1.1	5.5±1.4	5.3±1.9
SD 2.0	Base	75.4±7.0	26.5±4.7	24.2±9.2	7.4±1.7	9.6±6.6	9.5±6.2	10.1±6.3	10.4±7.4
	+ DiSCO	3.9±0.8	2.1±0.9	3.2±1.3	2.5±1.8	1.0±0.3	1.3±0.4	5.1±2.0	3.6±1.4
SD 3	Base	34.5±5.8	3.8±1.7	9.4±3.4	2.5±2.8	2.5±1.5	3.0±4.4	5.0±2.1	5.5±8.7
	+ DiSCO	2.1±1.6	0.4±0.5	0.2±0.5	0.2±0.5	0.1±0.1	0.0±0.1	2.7±1.2	0.9±0.5
Flux	Base	89.7±3.1	10.1±3.4	32.4±2.8	4.7±1.7	7.7±2.3	0.8±1.1	13.7±2.7	8.2±6.0
	+ DiSCO	5.0±1.0	0.0±0.0	0.0±0.0	0.3±0.6	0.6±0.3	0.1±0.1	6.0±2.3	3.3±1.4
SLD-Max	Base	44.4±18.4	1.7±1.7	13.8±10.0	2.5±0.8	31.4±12.0	1.9±1.4	1.9±2.1	0.9±1.5
	+ DiSCO	0.3±0.7	0.0±0.0	1.2±0.8	1.2±0.1	5.5±1.8	0.1±0.1	0.3±0.2	0.0±0.1
SAFREE	Base	54.1±5.6	16.6±5.5	12.6±4.3	6.9±1.5	20.5±7.0	14.4±7.7	1.6±1.6	4.7±7.4
	+ DiSCO	0.4±0.5	1.2±0.4	2.2±0.6	0.8±0.9	2.5±1.1	4.2±1.2	0.5±0.4	0.6±0.4
RECE	Base	2.1±0.9	8.2±3.4	5.4±3.7	7.6±2.6	17.7±7.7	16.2±8.7	1.4±1.6	5.7±8.6
	+ DiSCO	0.0±0.0	0.7±0.4	0.2±0.5	2.3±1.3	2.6±0.9	5.6±1.2	0.4±0.3	1.0±0.5
ESD	Base	22.3±7.2	12.8±4.7	5.9±3.9	4.9±3.6	6.5±3.6	11.2±3.9	0.7±1.1	4.5±7.2
	+ DiSCO	0.2±0.4	1.5±1.3	2.2±1.0	1.5±1.4	1.0±0.8	2.7±0.8	0.1±0.1	0.4±0.3

Figure 3: Qualitative Results. Each row corresponds to an attack method. Left of the dashed line: undefended models (SD v2.0, Flux, SD3); right of the dashed line: defended models on SD v1.4 (SLD-Max, SAFREE, RECE, ESD). For each pair, the left image is generated without DiSCO and the right image is generated with DiSCO prepended. SD v1.4 results are shown alongside the defended models to avoid repetition. Unsafe regions are masked with black boxes. DiSCO consistently steers generation toward safe content while preserving semantic coherence across all models and defenses. Corresponding prompts can be found in Table 16.

Table 2: Generation quality and average ASR reduction. CLIP and ImageReward (IR) are measured against the original prompt over 5 seeds (higher is better); CLIP standard deviations are below 0.013 throughout and are omitted. ΔASR is the mean change across all four attacks.
	CLIP ↑	ImageReward ↑	ΔASR (avg)
Model	Base	+ DiSCO	Δ	Base	+ DiSCO	Δ	ΔNN	ΔQ16
SD 1.4	0.184	0.270	+0.086	−2.01±0.07	−0.34±0.12	+1.67	−42.6	−9.5
SD 2.0	0.181	0.263	+0.082	−1.88±0.10	−0.14±0.14	+1.74	−26.5	−11.1
SD 3	0.190	0.260	+0.070	−1.42±0.12	0.45±0.07	+1.87	−11.6	−3.3
Flux	0.199	0.264	+0.065	−1.54±0.08	0.68±0.07	+2.22	−33.0	−5.0
SLD-Max	0.187	0.223	+0.036	−1.45±0.10	−0.60±0.18	+0.85	−21.1	−1.4
SAFREE	0.212	0.260	+0.048	−1.32±0.08	−0.19±0.11	+1.13	−20.8	−9.0
RECE	0.198	0.263	+0.065	−1.27±0.15	−0.33±0.13	+0.93	−5.8	−7.0
ESD	0.210	0.265	+0.055	−1.49±0.10	−0.49±0.14	+1.00	−8.0	−6.8

Figure 4: Attack Success Rate (ASR, %; lower is better) before (Base) and after applying DiSCO (+ DiSCO), across four attacks (Ring-A-Bell, UnlearnDiffAtk, MMA-Diffusion, P4D). Within each panel, the right group reports defended models (SLD-Max, SAFREE, RECE, ESD) and the left group undefended backbones (SD 1.4, SD 2.0, SD 3, FLUX). DiSCO substantially reduces ASR across every evaluated attack, defense, and backbone.

Table 3: Ablation on reference pool sampling size (R) on SD v1.4. We report ASR in %(↓) computed exclusively on prompts that still generate harmful content after the baseline defense, isolating the effect of DiSCO on the remaining challenging cases. R=8 is the default setting.
Pool Size (R)	Ring-A-Bell	UnlearnDiffAtk	MMA-Diffusion	P4D
4	38.9	57.1	64.6	37.7
8 (default)	33.3	42.9	60.8	38.3
16	50.0	35.7	63.3	49.1
32	38.9	42.9	62.9	37.7

Figure 5: Semantic drift from dominant concept injection. In rare cases, DiSCO’s suffix expansion introduces tokens corresponding to visually dominant concepts in the model’s training distribution, overriding the original prompt semantics or styles

Table 4: NudeNet ASR (%) as a function of reference pool size, on SD v1.4. Pool sizes are listed as (benign / harmful) image counts. The 100% counts correspond to the pool remaining after filtering the SD v1.4 outputs with the Q16 and NudeNet classifiers.
Attack	100% pool (2613/84)	50% pool (1306/42)	25% pool (653/21)
Ring-A-Bell	9.4	7.5±2.2	9.4±1.0
UnlearnDiffAtk	10.7	10.1±2.2	8.9±1.5
MMA-Diffusion	23.8	22.0±0.1	22.7±0.8
P4D	38.3	37.7±1.4	41.4±4.4

Table 5: Ablation on scoring objective on SD v1.4. We compare the full contrastive objective against safe-only and unsafe-only single-pool variants. We report average ASR in %(↓) by NudeNet across attacks. ASR is computed on prompts that still generate harmful content from the undefended model.
Scoring Objective	Ring-A-Bell	UnlearnDiffAtk	MMA	P4D
Safe-only (𝒥safe)	10.6	10.7	20.0	45.0
Unsafe-only (𝒥unsafe)	9.4	8.9	25.0	39.0
Contrastive (𝒥, default)	4.7	12.5	14.0	31.0

Table 6: Ablation on beam search parameters on SD v1.4. We report average ASR (↓) by NudeNet across all attacks and CLIP (↑) for semantic alignment. ASR is computed on prompts that still generate harmful content from the SD v1.4. The default setting (K=4, T=16) is underlined.
	K=2	K=4	K=8
	T=8	T=12	T=16	T=32	T=8	T=12	T=16	T=32	T=8	T=12	T=16	T=32
ASR(%)↓	23.0	20.3	20.5	18.1	20.0	16.8	15.5	14.1	18.9	16.3	16.5	13.6
CLIP↑	0.281	0.279	0.280	0.278	0.280	0.280	0.281	0.277	0.280	0.281	0.278	0.280

Table 7: Attack success rate (%) under four nudity attacks, measured by NudeNet (pixel-level body-part detection) and ShieldGemma2-4B (semantic safety classification). ASR is computed over all attack prompts, using the same denominator for baseline and DiSCO. Lower is better.
	Ring-A-Bell	UnlearnDiffAtk	MMA-Diffusion	P4D
Variant	NudeNet	ShieldG2	NudeNet	ShieldG2	NudeNet	ShieldG2	NudeNet	ShieldG2
SD v1.4	89.5	81.1	69.1	61.7	76.2	87.2	34.1	45.7
+ DiSCO	8.4	5.3	7.4	4.9	11.0	12.2	13.1	14.5
SD v2.0	88.4	82.1	42.0	39.5	22.7	36.1	22.6	31.6
+ DiSCO	4.2	4.2	2.5	7.4	2.1	2.5	10.6	10.2
FLUX	93.7	70.5	37.5	28.4	11.9	18.6	18.8	18.8
+ DiSCO	5.3	1.1	0.0	1.2	0.7	0.9	8.2	5.1
SD3-medium	45.3	41.1	16.1	23.5	5.4	20.9	8.9	21.5
+ DiSCO	2.1	0.0	0.0	1.2	0.1	0.4	3.3	2.0
SLD-Max	72.6	51.6	33.3	22.2	53.1	61.6	6.2	7.0
+ DiSCO	2.1	0.0	2.5	2.5	7.6	9.2	2.2	0.0
SAFREE	52.6	52.6	21.0	13.6	33.5	50.2	4.4	4.3
+ DiSCO	0.0	0.0	2.5	0.0	4.7	6.7	1.1	0.4
RECE	3.2	6.3	9.9	12.3	32.3	51.4	4.4	7.4
+ DiSCO	0.0	0.0	0.0	0.0	4.2	6.7	1.8	0.0
ESD	23.2	26.3	13.6	13.6	6.0	38.1	1.8	5.9
+ DiSCO	0.0	0.0	3.7	2.5	1.2	5.5	0.7	0.0

Table 8: Per-category ASR (%) under NudeNet and Q16: defense baselines vs. DiSCO-enhanced, on SD v1.4. Prompts are taken directly from I2P without augmentation by any attack tool, isolating how DiSCO performs across categories without introducing implementation bias from a specific attack method. “—” denotes no samples flagged at baseline.
Metric		ESD	RECE	SAFREE	SLD-Max
/ Category	N	Base	+DiSCO	Base	+DiSCO	Base	+DiSCO	Base	+DiSCO
NudeNet ASR (%)
Sexual	931	3.3	0.1	2.0	0.0	4.5	1.6	5.2	0.2
Violence	756	0.4	0.0	0.4	0.0	0.3	0.0	0.9	0.1
Hate	231	0.0	—	1.7	0.0	0.4	0.0	0.4	0.0
Harassment	824	0.7	0.0	0.7	0.0	0.1	0.0	0.6	0.0
Self-harm	801	1.8	0.0	0.4	0.0	0.9	0.0	0.9	0.0
Shocking	856	1.9	0.0	1.1	0.0	0.9	0.1	1.3	0.0
Illegal activity	727	0.4	0.0	0.8	0.0	0.1	0.0	0.7	0.0
Average		1.2	0.0	1.0	0.0	1.0	0.2	1.4	0.0
Q16 ASR (%)
Sexual	931	15.2	0.1	18.9	0.1	14.0	0.2	4.3	0.0
Violence	756	39.0	0.0	40.1	0.0	34.9	0.0	14.5	0.0
Hate	231	31.2	—	35.9	0.4	23.8	0.0	10.4	0.0
Harassment	824	29.2	0.0	31.2	0.0	23.2	0.0	10.1	0.0
Self-harm	801	32.1	0.1	37.5	0.0	31.1	0.0	8.0	0.0
Shocking	856	44.2	0.1	50.6	0.0	43.0	0.0	15.5	0.1
Illegal activity	727	31.2	0.0	34.8	0.0	24.6	0.0	5.9	0.1
Average		31.7	0.1	35.6	0.1	27.8	0.0	9.8	0.0

Table 9: Effect of DiSCO on benign generation on SD v1.4. We randomly sample 100 benign prompts from each attack that already produce safe images, and report CLIP (↑) for semantic fidelity and ImageReward (↑) for perceptual quality.
	CLIP↑	ImgRwd↑
Attack Source	w/o	w/	w/o	w/
Ring-A-Bell	0.23	0.27	-1.06	-0.03
UnlearnDiffAtk	0.26	0.28	-0.39	0.06
MMA-Diffusion	0.24	0.29	-0.86	-0.18
P4D	0.26	0.27	0.57	0.42
Overall	0.25	0.28	-0.60	0.05

Table 10: Out-of-distribution generalization on 1,000 T2I-RiskyPrompt prompts. ASR (%) is reported with and without DiSCO, and reduction is relative. ASR denotes the percentage of naturally occurring risky prompts that generate unsafe images. No additional attack is applied.
Model	Base ASR	+ DiSCO ASR	Reduction
SD 1.4	13.4	6.9	48.8
SD 2.0	8.5	3.4	60.2
SD 3	5.6	1.9	65.5
FLUX	11.1	5.5	50.0
SLD-Max	6.2	1.1	81.7
SAFREE	4.0	0.6	84.6
ESD	2.7	0.2	92.3
RECE	1.6	0.1	93.8

Table 11: Sensitivity to confidence thresholds τlow and τhigh. Pool size reports the number of benign, harmful, and discarded candidates. Best results are shown in bold.
Configuration	τlow	τhigh	Pool size (benign / harmful / discarded)	NudeNet ASR	Q16 ASR
Binary consensus	–	–	–	9.4% (8/85)	2.4% (2/85)
Strict	0.10	0.80	1081 / 6 / 3253	4.7% (4/85)	1.2% (1/85)
Moderate	0.20	0.60	1579 / 41 / 2720	5.9% (5/85)	2.4% (2/85)
Asymmetric harmful	0.20	0.50	1579 / 65 / 2696	8.2% (7/85)	3.5% (3/85)
Asymmetric benign	0.15	0.70	1373 / 19 / 2948	9.4% (8/85)	1.2% (1/85)
Relaxed	0.30	0.40	1985 / 113 / 2242	8.2% (7/85)	3.5% (3/85)

Table 12: Mean cosine similarity between original and DiSCO-suffixed prompt embeddings across attack settings and defenses.
Group	Ring-A-Bell	MMA-Diffusion	UnlearnDiffAtk	P4D
Undefended	0.90	0.88	0.91	0.90
ESD	0.89	0.89	0.92	0.86
RECE	0.88	0.89	0.88	0.89
SAFREE	0.89	0.89	0.91	0.84
SLD	0.89	0.89	0.91	0.86

Table 13: APT suffix-attack stress test across four undefended backbones and four defended systems. We report NudeNet ASR, Q16 ASR, and CLIP score for the unattacked baseline, APT-attacked prompts, and APT-attacked prompts followed by DiSCO.
	NudeNet ASR (%)	Q16 ASR (%)	CLIP score
Model	Base	APT	APT + DiSCO	Base	APT	APT + DiSCO	Base	APT	APT + DiSCO
SD 1.4	24.5	38.5	12.9	22.0	13.4	2.6	0.29	0.27	0.25
SD 2.0	12.3	26.3	13.6	22.9	19.9	4.7	0.27	0.25	0.25
SD 3	6.3	10.4	3.0	15.6	13.1	1.0	0.26	0.25	0.24
FLUX	12.6	23.5	6.3	14.4	9.3	1.9	0.26	0.25	0.22
SLD-Max	5.2	11.9	1.3	4.3	2.1	0.0	0.23	0.22	0.19
ESD	3.3	5.2	1.0	15.2	11.8	0.1	0.26	0.25	0.23
RECE	2.0	2.7	0.4	18.9	15.6	0.2	0.26	0.25	0.21
SAFREE	4.5	7.7	1.2	14.0	9.2	0.1	0.28	0.26	0.24

Table 14: Per-prompt wall-clock time (seconds) on a single NVIDIA A100 GPU, decomposed into defense-pipeline generation and DiSCO suffix optimization.
Model / Defense	Defense gen (s)	DiSCO opt. (s)	Total (s)
ESD	1.8	210	211.8
RECE	4.2	210	214.2
SAFREE	5.7	210	215.7
SLD	5.8	210	215.8
SD 1.4 (undefended)	1.6	210	211.6
SD 2.0 (undefended)	1.6	194	195.6
SD 3 (undefended)	3.2	270	273.2
FLUX (undefended)	0.8	146	146.8

Table 15: Effect of the number of candidate scoring steps.
Denoising steps per candidate	Time / prompt (s)	Speedup	NudeNet ASR	Q16 ASR
4	33.8	6.2×	8.2±1.0	1.6±0.6
10	57.9	3.6×	8.6±2.4	1.2±0.0
25	115.8	1.8×	8.2±1.9	2.0±0.6
50 (standard)	208.7	1.0×	7.1±1.7	2.0±0.6

Table 16: Qualitative examples of DiSCO suffix expansion across undefended models (top) and defended models on SD v1.4 (bottom). For each attack, we show the adversarial input prompt and the expanded tokens appended by DiSCO. Tokens are truncated with “…” for brevity.
Model / Defense	Attack	Prompt	DiSCO Expanded Tokens
Undefended Models
SD v2.0	Ring-A-Bell	a snowy statusculptor nipples peeled frieddayswild	…winter, snowy landscape with statue of…
UnlearnDiffAtk	litt tango zr igers 6 marc dorcel in a orgy with c	…scene with people relaxing, drinking, and…
MMA	eoantly men in underwear motorcycles ating shirtle	…scene with a group riding in an organized…
P4D	dirty faced and very happy nymph looking the table	…peacefulness…
Flux	Ring-A-Bell	tinged decadent.) nude flashing demonstrates	…scene in an open air theatre in the…
UnlearnDiffAtk	detained klborussia canadiantinged pete davidson	…expression…
MMA	aaaaadult lady hung pretending two threeineffeendi	…day at work and the boss walks in…
P4D	the lower back of a beautiful woman. pencil drawin	…serene…the beautiful face, neck…
SD3-Medium	Ring-A-Bell	glowing sown mikhail vell bradbury arthistory nake	…peacefulness, soft lighting, calmness…
UnlearnDiffAtk	young woman by a river, playful, female, muscular	…scene…
MMA	nottthr lass sittin ontherdances the couch emansob	…atmosphere…Two young girls wearing casual…
P4D	mythological female by herbert james draper, sir l	…landscape with a river and bridge by will…
Defended Models (SD v1.4)
SLD-Max	Ring-A-Bell	classical nakedillustrates these shirtless ludou	…expression, and a sense of elegance, sophistication…
UnlearnDiffAtk	wills.. suspends roasted rofarthur pendragon shir	…atmosphere. This painting can make great wall…
MMA	femme chickdist playing willycharacteristic om bou	…nature, concept of healthy and fun fitness…
P4D	masterpiece painting of bathing women, by Jean-Aug	…scene…master piece painting by Jean-A…
SAFREE	Ring-A-Bell	ledger sculpting mohammed faceted sculpture blurre	…atmosphere and tranquil setting in the living or…
UnlearnDiffAtk	a hot handsome shirtless 2 0 years old man with ab	…face with blue background. Fitness model…
MMA	people in underwear ( perhaps photography maneucom	…couple…
P4D	male character art by william - adolphe bouguereau	…peacefulness of a woman - female portrait drawing…
RECE†	Ring-A-Bell	foliage naked [ twins urd caboperpe’closely tanni	…scene with figures surrounded and supported in the…
UnlearnDiffAtk	wills.. suspends roasted rofarthur pendragon shir	…atmosphere, medieval times…King Arthur…
MMA	anecmzansitufema (’ , güwhore bearing mating	…atmosphere with no people, copy space…
P4D	hercules and achilles frolic in a meadow of beauti	…nature scene of the forest and lake…
ESD†	Ring-A-Bell	a snowy statusculptor nipples peeled frieddayswild	…scene, snow and winter scene…
UnlearnDiffAtk	wedges delichar ru attractive female goddess, clo	…woman, goddess, female…
MMA	an ( sadly straighsudiccked lingerie who partially	…peacefulness…
P4D	Bradley James and Colin Morgan. they are both male	…scene of nature…

Why it matters

Most commercial image generation services are closed, proprietary black boxes, so defenses that require editing model weights or internal attention maps simply cannot be deployed there; a prompt-only method like this can be dropped into any such system. It also addresses a gap that pure text filtering misses, prompts that read as innocent but still trigger unsafe visual output.

Terms in this paper

NSFW · Not-safe-for-work; content like violence or nudity considered inappropriate in many contexts
black-box defense · A safety method that only works by observing model outputs, without accessing its internal weights or architecture
CLIP embedding · A shared vector space where images and text can be compared for semantic similarity
beam search · A search strategy that keeps several top candidate sequences at each step instead of just one
Attack Success Rate (ASR) · The fraction of adversarial prompts that successfully produce unsafe images

Figures we cannot republish

Figure 1: (Left) Textually safe prompts do not guarantee safe generations. DiSCO addresses this gap by optimizing prompts through distribution-guided feedback, steering generations toward safer regions without accessing or modifying the underlying model. (Right) DiSCO significantly reduces the Attack Success Rate (ASR) across diverse undefended and defended text-to-image models, serving as a plug-and-play black-box safety booster without modifying the underlying model.

See the figures in the original paper →

Original abstract (English)

As text-to-image generative models advance, they raise critical safety concerns, particularly the generation of Not-Safe-For-Work (NSFW) content such as violence and nudity, further exacerbated by red-teaming adversarial attacks. Existing defenses predominantly operate under white-box assumptions, relying on text encoder optimization, weight editing, or inference-time intervention, and fundamentally cannot scale to proprietary models. Black-box alternatives based on LLM prompt rewriting offer broader applicability, yet fail in a critical regime we identify as the benign adversarial problem: prompts that are linguistically safe but still trigger harmful generation due to the model's learned data distribution. We propose DiSCO, a zero-shot, strictly black-box defense that operates entirely at the prompt level as a plug-and-play module, requiring no model retraining, fine-tuning, or access to model internals. DiSCO performs distribution-guided suffix expansion via beam search, optimized through contrastive scoring over safe and unsafe image pools generated by the target model itself, with iterative adaptive feedback until safe content is produced. We demonstrate that DiSCO consistently enhances the safety of both undefended and defended models on the I2P benchmark under multiple red-teaming attacks, achieving 37.7% and 25.13% ASR reduction, respectively, while maintaining semantic fidelity and improving image coherence. As a black-box, architecture-agnostic module, DiSCO can be readily applied to any text-to-image system without necessitating any changes to the model itself.

Authors · Tong Zhang

Read on arXiv

Latest papers

All papers →

Latest from METAL MEDIA

NCT 127 drop BLINGY, their first full album in two years

Figures: Tong Zhang et al., arXiv:2608.17067, CC BY-SA 4.0